Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Billosaur writes "From NPR, we get a Marketplace story about the theft of corporate laptops and the sensitive data they may contain, specifically how to handle the repercussions. From the story: 'TriWest operates in about 21 states. It's based in Phoenix, Arizona. In December of 2002, somebody broke into the company's offices and stole two computer hard drives.And those hard drives contained the personal information of 550,000 of our customers from privates in the military all the way up to the chairman of the Joint Chiefs of Staff.' How they handled the situation earned them an award from the Public Relations Society of America."

I didn't think any excryption was perfect. So what happens if they do encrypt the disk and the drive gets stolen. If they don't report it and the encrytion is broken what recourse do those people with compromised information/identities have?

XOR the data with itself. Since the key is the same length as the data, cryptanalytic attacks don't apply. Anyone who doesn't have the data, by definition, doesn't have the key. The ciphertext contains no clues to the plaintext and, in contrast to most crypto systems, is highly compressible. An additional convenience is that you can generate the ciphertext from one of the standard special devices without even needing the plaintext.

I realize you're joking, but do you even know what XOR is? Just how exactly do I perform an exclusive or conditional on data to get any results resembling cryptography in even the most distant ROT-13 sense?

Well, not unless the key is as long as they data. If it is, then you can prove that the encryption is perfect.

In practice, though, the imperfect crypto that we have is damned good, and if you do encrypt you disks with something decent you can quite safely assume that no one who grabs the disks can read the data, as long as they don't have the resources of a major world government available to them (and maybe even if they do). If you're worried about whether

If they don't report it and the encrytion is broken what recourse do those people with compromised information/identities have?

A laptop theif isn't going to spend 3 months and 10,000 distributed computers to crack your laptop. Well... Maybe... If he thinks it was really critical, but chances are he might just format the drive and sell it at pawn shop.

In many cases true, but if you had sensitive (we're talking geopolitically sensitive, not credit-card and Social Security numbers sensitive) then such an assumption might be unwarranted and a very bad idea. Certainly it's not a chance that I want people taking if I was in a position of responsibility.

"chances are he might just format the drive and sell it at pawn shop."

Exactly. Thieves are usually looking for fast money. If the data is easy to get, they get it. If it's not, then they aren't going to waste their time and maybe expose themselves as the thieves when they can hock a quick bit of change and move on to the next target of opportunity.

There are several dissertations easily found through Google about making boot media (such as a USB memory stick) with a really good key for the disk drive itself,

I didn't think any excryption was perfect. So what happens if they do encrypt the disk and the drive gets stolen.

Let me get this straight. There are two scenarios: leaving the disk unencrypted, and encrypting it. Under scenario 1, if the laptop is stolen, the thieves have free access to all the info on the hard drive. Under scenario 2, the thieves have potential access to all of the info on the hard drive, but only if they break the encryption.

"I don't know what world you live in, but people need access to sensitive data on their laptops -- espcially if they are in an area that doesn't have internet / communications availability.

You can take precautions such as encrypting the disk -- but many people can't do their jobs without access to that information.

Before computers, people often put files in their cars, or carried pen / pencil notebooks. The requirements to have that information available away from the office haven't changed."

I know what world you live it. It is the world of video games and powerpoint presentations with cute little pie charts.

In the 60s (the 40s and 50s were before my time) we got access to sensitive data by going to the office, passing an armed guard, signing in and sometimes using several keys or typing in combinations to get into certain rooms. Yes, you could take notebooks (paper ones) and pens and pencils with you in your car. You might also take a printout or so with sensitive data from one place to another, but that was pretty rare. There were telecommunications back then and you could even get to your data over those links, which were a lot more secure than todays WiFi and dial-up.

What changed is that computers became toys, and many of the people using them now know nothing about the underlying technology other than it's easier than using an adding machine. Ninety nine percent of the problem is that the boobs entrusted with these toys didn't take even common sense precautions with the physical security of the devices. Given the mindset of such people, there is zero hope that they would know enough to take the proper electronic precautions.

I maintain that if the data is REALLY important, and that includes all the examples given above, the the proper way to use a laptop is as a dumb terminal with a highly encrypted communications link back to the actual data. Such a link can happen over the Internet, or via a satellite link. There is really no excuse for carrying such data around, in the past, now, or in the future.

Maybe in your industry -- but doctor's have carried patient charts home, to and from hospitals, etc., forever. My father used to have a milk crate full of active patient charts in his car trunk.

There is no network in most nursing homes, and most hospitals won't allow their doctor's (or any staff) direct access to the internet and the ability to run something like TightVNC & SSH. A physician who downloads their currently hospitalized / nursing home bound patient charts to their laptop has no other wa

I mean, really! This is health-care data for top military officials! Who needs to take that data on the road with them? Encrypt, stick it in a secure database, on a server in some closet in HQ. At least make it take effort to get at, no?

While California's SB1386 specifically mentioned encryption as a reason for not having to disclose to customers under that law, other laws do not. Specifically Wisconsin Act 138 does not mention encryption as a way to preclude disclosure. Basically Wisconsin's law states if someone unauthorized has a clients data, you must tell the client about it. Now, of course I am not a lawyer, nor do I play one on TV, but I know this is a new law (March 16th, 2006) and have any Jurisprudence clarifying this. On the

Specifically Wisconsin Act 138 does not mention encryption as a way to preclude disclosure. Basically Wisconsin's law states if someone unauthorized has a clients data, you must tell the client about it.

If the data is on an encrypted disk, does the thief really have the data if they steal the encrypted disk?

If the data is on an encrypted disk, does the thief really have the data if they steal the encrypted disk?

Yes. Because the thief may be able to decrypt the data because they also copied down the password/key that was on a post-it note hidden under the keyboard of the computer. Or they might exploit a flaw in the encryption. Or they manage to socially-engineer access to the key needed to decrypt the data. Or they might have installed a key-logger to get the key and then came back a week later to get the drives too.

> Research Whole Disk Encryption. Doesn't seam like that would be a solution for the server drives stolen for this article.
You either have to key in a password on any power-up, or have some device authorizing on boot. guess if your running multiple distant site redunency you could have it retrive the password across the network somehow, so it's authentication could be pulled if you lost just one server...

For valuable data, it seams like physical security of something that does the unlocki

Unfortunately, I don't think that trick would work so well. At least, not very practically. You'd need to be putting some significant current through those wires in order to reliably degauss a hard drive (remember, those hard drives are usually in ferrous-metal cases). I've never done the math, but I have a feeling it might make your doorframes into serious electromagnets. The thieves might catch on when all of their tools get ripped out of their pockets and stick to the doorjambs as they brush past it.Now,

Recall the trick used in Neil Stephenson's Cryptonomicon: Wrap several coils of wire around the doors and windows, and during the evening run several amps through them. Anybody stealing a hard drive will be left with a paperweight.

Works of fiction may not offer the best advice, real world meet artistic license. People have tried to erase disks with degausers, bulk video tape erasers, etc without success.

Tip 1: When you make your get away, float above the carpet like a feather caught in the wind.Tip 2: If you encounter security or other obstacles, aim for the biscuits.Tip 3: Make sure you check the laptop for any homing devices that will help them track you down.Tip 4: The password is usually the username with 123 at the end or the their children's ages.Tip 5: Get the evidence out of your hands as quickly as possible to beat the feds.Tip 6: Relax and enjoy reading the next day's headlines on Slashdot about stolen private information.

I actually listened to this story last night on the way home (or the day before, can't remember). Anyway, at first I was shocked when I heard the intro, they lost all this sensitive data, did some stuff and then won a PR award. If the actions they took were so great shouldn't they have won some sort of privacy award. Winning a public relations award makes it sound like you did a great job covering it up. But actually listening to the story I found that they really did handle it in a great way for their customers.

So I am researching encryption for this very reason (laptop encryption) anyone have any links or insights into why anyone would choose file/directory encryption? I am heavily leaning towards whole disk, mainly because how can you be sure you get everything. (i.e. temp files, pagefiles, hibernation files) I have seen some items regarding "inteligent encryption" but I just can't see how any program can "know" what to encrypt and what not to without tons of administrative overhead.
That's why I like whole di

But for individual workstations/laptops with single users where there is no protection of the data from multiple users, whole disk works well (except for/boot with the kernel and an initrd with dm-crypt tools). I have / and swap encrypted and don't have to worry about theft much with respect to private data.Individual directory/file encryption is important for multi-user workstations/servers, where you have to worry about other users getting the files when owner is not logged in. encfs and the like provi

Generally, disk encryption is great if a machine is stolen; however, it doesn't offer you any benefits should the machine be compromised following login of the encyption product (generally at boot). Some products have timeout modes kind of like a screensaver where it forces a login to the encrpytion package following a period of inactivity, but basically disk encryption isn't a safe bet for complete safety. For instance, it can do nothing if someone remotes in to the machine or a "rogue" employee accesses

My Mac OS X laptop is set to require a password to wake it from screen saver or sleep. I make it a point to never leave it without sliding the cursor to a hot corner to start the screen saver (or sleep it if it isn't doing anything in the background and I'm not coming right back). That coupled with disk encryption would be a pretty hard thing to defeat.

Short of that, storing important information on encrypted disk images goes a long way towards solving the problem, though.

But that is user habits, just like my ctl-alt-del when I leave my windows notebook for any length of time. Most users do not do this (and it sacres me).I use disk encryption on my notebook through IBM's TPM setup, and then I run container encryption on-disk for two reasons. First reason: I have top-security documents on my machine. They are encrypted, and I must access a server to obtain a decryption key every time I want to view them. The encryption is by authentica. I do not trust this encryption, t

A seperate true-crypt container is used to store my personal information, saved web-pages, personal projects, my website backup, etc. This is because I also do not trust my employer. The notebook is theirs, but not all the data is.

Why do I think that if your work is as confidential as you say it was, and you're going to the obvious effort to ensure its sanctity as best you possibly can, that there would not be a clause somewhere that mentioned your use of company resources for personal purposes, and that I

There is, in fact, a policy regarding private use of company assets. Basically as long as what I do is only step one and two and omits "3) Profit!", then I am fine. Thus I do not op the site in my sig from my notebook, but I do op: farmersreallysucks.com [slashdot.org]. That is protected speech, and allowed (on my breaks) to be operated on with company bandwith and assets. Even to that end we run an application called CNB that backs up the entire PC. There is a special folder that we can use to store personal stuff t

ARGH. This is the second time this has been done. NPR does not produce or distribute Marketplace. NPR has nothing to do with Marketplace. It's produced by American Public Media. Please get it right. You're even LINKING TO APM!

Perhaps not the worst faux pas I have ever made, but certainly an honest mistake. I am fully aware that NPR does not produce Marketplace, but NPR does carry the show, and I should have indicated it that way, or mentioned American Public Media. Guess I have to turn in my Guy Noir trenchcoat now.

...more specifically the entertainment value of being tazered, when you get caught trying to board a flight with it.;-)

Actually, believe it or not, as scary as this sounds, it's more like if, not when.

Sure, the TSA has sensors that can check for certain high-order explosives (including RDX, aka cyclonite, the main explosive ingredient of Composition C4) but it's not whether or not the sensors detect it, it's whether or not the TSA employees bother to check.

I used to work with certain security personel and they found it easy to get guns on planes. I am talking post 9/11. I was involved in voice recording and if our guys were going into a sensitive area they did not want to be met by security at the airport who could issue them with weapons as they may get made by the bad guys. They would secrete a couple of guns in the recording equipemnet and they never got caught. OK, it is easier to stay calm and distract the guys doing the scanning when you know you wi

I had a laptop stolen one Friday night in San Francisco. A couple of hours later, the cops picked up the thief for other reasons, and since he didn't look like the type who'd own a laptop, they called my company's security department (whose number was plastered all over it.) By Sunday afternoon the security department had called me and verified that it was my company-owned laptop, and we talked to the police. Monday morning I went into the cop shop to identify it, they couldn't find it in the property ro

consider Israeli airlines... when was the last time they got hijacked or blown up? The Israelis take security very seriously, and a lot of it is not visible at the airport, it's behind the scenes... such as depressurizing baggage, well trained plain-clothes security on board... it costs a lot of money, much more than a few smartly dressed low-pay security guards at a screening desk.

contrast this with other airlines - it's all about making people feel confident.

The Israeli security you mention is real security, not just handwaving PR. They are winners. The empty American "security" gestures you describe, from airlines to marketing, simulates security ("simcurity"). It's a loser.

As usual, the best practice is real security, with tasteful promotion that people can trust as much as the security itself.

I work as the senior engineer for the desktop engineering department of a large west-coast healthcare organization with over 20,000 PCs.

Not only do we encrypt EVERY laptop, regardless of if we think it contains PHI; theft of desktop equipment has prompted us to encrypt EVERY desktop, regardless of if we think it may contain PHI. We also encrypt and monitor every PDA (including phones with sync).

The software: Millions of dollars.Support: Millions of dollars.Not being sued in California for losing PHI: Priceless.

There's very little you can do after the fact (though the C4 idea above was cute). The key is to do what somewhere I once worked did: make sure that there are effective corporate policies in place long before hand to make sure that laptop thieves don't profit when they get their hands on sensitive information.

For example:

Have policies that make corrupting corporate data easy, but correcting it tedious/impossible.

Give different departments "ownership" of different data and encourage them to distribute it to people who need it via e-mail (hand copied from the application), screen shots, or exported spreadsheets that do not correctly propagate column names.

Encourage employees to edit the e-mails to produce versions of the data that they think are more accurate, and distribute them with names like "New (revised) revision of Q4 draft data dump--updated, with corrections by MQR for some of the errors introduced by BC in Q3"

Have data retention policies that assure that every laptop has at least twenty such interpretations of any key data on it at any time.

Make test data by permuting fields (and words/digits within fields) between rows of live data. Do not clearly distinguish live data from test data, to assure that some of these will end up on laptops as well.

With a few simple precautions like these, you can be sure that the bad guys may steal the laptop, and the data, but they won't have any more idea what to do with it than you do.

Laptops get stolen. It's a reality of life. The worst thing is to compromise cutomers/other's data. This can easily be prevented by using crypto for data directoris. GPG has a Windows drop-in for the clueless.

True, PGP Co. has a product for the Windows "clueless." But doesn't better protection start by asking yourself if the "clueless" should actually be handling or otherwise be responsible for this type of data?

i fail to see why computer theft is still an issue - even i implemented a relativly simple, yet, as far as i can see, 'secure enough' system for these situations:
all 'interesting' files are inside AES256 encrypted container-files wich are mounted via loop-devices.
if, for some reason, a server or machine reboots, it asks the next higher server for the password it needs to decrypt itself via an encrypted network connection. if a machine is reported as stolen, the server that has the task of sending the passwords gets advised of this, and simply wont send the corresponding password anymore. the peak of this pyramid of trusted machines is an off-site server far, far away. thus, if the hierarchy is broken (e.g. by computer theft) anywhere along the way, it's a matter of seconds to render all information contained on the stolen machine completly useless.
if i came up with this, surely the admins of REALLY important data can?

There is one other possibility that has not been considered and that is that the break-in was organized by a foreign intelligence agency in an apparently successful operation to capture records relating to United States military personnel. If this is true then it ups the ante significantly because foreign intelligence agencies have the resources and expertise to organize these types of raids despite the best private security and especially if the operatives are willing to kill for the information. They could have infiltrated across the Mexican border, where security is sorely lacking, and gone anywhere in the US without attracting much attention. Most corporations do not employ the types of security measures that the military does and so they would probably be caught off guard by a commando style raid in the middle of the night. The night watchmen doesn't get paid enough to be killed over a couple of hard drives and all he saw were men in balaclavas before he was knocked over the head with the butt of an mp5 and tied up...you get the idea. This may have been a professional job.

Most corporations do not employ the types of security measures that the military does and so they would probably be caught off guard by a commando style raid in the middle of the night. The night watchmen doesn't get paid enough to be killed over a couple of hard drives and all he saw were men in balaclavas before he was knocked over the head with the butt of an mp5 and tied up...you get the idea. This may have been a professional job.

What you just described would not have been a professional job. A profe

In that case, a 1331 h4x0r could just use a spy satellite to log on to the laptop without getting traced, and retrieve the records he wanted, without ever having access to fancy lipstick gadgets. I'm not sure what he would need the spy satelite for, but it sounds a lot more advanced than just connecting over teh Intarweb.

I'm suprised my company doesn't take advantage of Dell's Ownership Tag (there is an Asset Tag as well) to put the company name on the POST screen. It won't stop systems from being stolen for the data, but it will stop those looking to resell the hardware.

Compaq and I would assume the other major companies have this as well.

I didn't (couldn't) read the linked article, so I'm just going to comment on the summary.

I was not so fortunate and read comments such as this:

"When the information theft occurred against my company, we discovered that existing state and federal laws protecting consumers from identity theft had been surpassed by the individuals perpetrating the crimes, so I made 'identity theft' my fight," said McIntyre.

Okay, I believe that "When the information theft occurred against my company" can be translated into "W

FYI, this story was a followup to a longer story about laptop and identity theft. The original story did indeed focus a lot on data encryption.

From the original article:"This is Jonathan Zittrain, a co-founder of the Berkman Center for Internet and Society at Harvard Law School. He says he's not surprised that all of this information is walking around on portable computers. People want to be productive on the run, he says. But he says there are pretty sure-fire ways to protect sensitive information. Like, encrypting it, or leaving the data on the main server and remotely tunneling through the Internet to work with it."

Way to declare this the "worst article ever" in the same post you brazenly declare you didn't read it, by the way. A bold move, even by Slashdot standards.

Windows 2000 and XP Pro are able to encrypt files and folders out of the box. You could just encrypt your profile in 'Documents and Settings' for essentially the same effect as Filevault on Mac. Setup the Administrator account as a Data Recovery Agent for the same effect as the File Vault master password. This is what we're doing for the Windows users in our department who won't or can't switch to Mac. (We're actually using this as a temporary solution while we look at PGP)

You're being a little hard on our truthsmythes, aren't you? Haven't you heard the good news about the PSRA's "prestigious" Silver Anvil award? (So named because it is where the truth is hammered until the clients of corporate PR can see their million-dollar reflections.) As they like to modestly note:

The Silver Anvil Awards program has grown in scope and stature since its inception in 1946, and awards are now given in 56 categories and subcategories. To date, more than 1,000 organizations have received

Great idea!...except for the fact that it's overly complicated and relies on end-user cooperation. There are a number of at-boot hard drive encryption suites that are (a) cheaper than external drives, (b) don't rely on end-user participation and cooperation, and (c) address the fact that your swap and cache information may be full of useful data, and you leave it unencrypted.

Given that these external hard-drives are alot easier to pick-up and walk away with

Isn't that exactly why the external hard-drives are more prone ot being stolen?

but rarely, due to training, do we find an unattended hard-drive

If your training works, why not just train them not to leave laptops unattended?

Your post raises another interesting point, though: what if people use internal hard drives, encrypted, but a user brings in their own external drive? That seems like a potential security flaw waiting to ha

Why not take it further and have 5 locations using VPN and set the physically seperate location up like RAID 5 so no location actually has the data. If any hard drive gets stolen it has a maximum of every 4th chunk of data (4 chunks and a check chunk = 5 locations). A thief would need to break into all locations at the same time to get the data. If one location is broken into the data can still be recovered using the check chunks but the thief cannot recover any data. Encryption can easily be broken but a thief cannot see what he does not have.

Why not take it further and have 5 locations using VPN and set the physically seperate location up like RAID 5 so no location actually has the data.

Well there has to be some place to assemble the data again, unless it is in log term storage.

The security here depends on the motives of the thief, if the prize is a laptop to pawn then encryption is probably a big enough deterrent to stop them getting at the data. The laptop will be formatted and pawned/ebayed.